Ivanti EPMM vulnerabilities
8 known CVE vulnerabilities in Ivanti EPMM, translated and rated.
- CVE-2026-7821High
Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity.
- CVE-2026-5788High
An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.
- CVE-2026-5787High
Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 has improper certificate validation, allowing a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates.
- CVE-2026-5786High
An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access.
- CVE-2026-6973HighActively exploited
An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.
- CVE-2023-35081HighActively exploited
A path traversal vulnerability in Ivanti EPMM allows an authenticated administrator to write arbitrary files onto the appliance. It affects versions 11.10.x before 11.10.0.3, 11.9.x before 11.9.1.2, and 11.8.x before 11.8.1.2.
- CVE-2023-35078CriticalActively exploited
CVE-2023-35078 describes an authentication bypass vulnerability in Ivanti EPMM that allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
- CVE-2026-10727High
Ivanti EPMM before versions 12.9.0.1, 12.8.0.3, and 12.7.0.2 has an OS command injection vulnerability that allows a remote authenticated attacker to execute arbitrary commands as root.